Serbia catches up with the GDPR

2. Databases Central Register Removal

The new Law has fully removed and terminated the Databases Central Register, which was established under the old law and kept by the Commissioner for Personal Data Protection (the "Commissioner"). Those amendments have been effective since 9 November 2018.

3.Extension of territorial application

A more precisely defined and extended territorial application of the provisions of the Law is significant, as it refers to controllers and processors who process personal data of persons domiciled or residing in Serbia, regardless of the controller's or processor's location. This Law applies to the processing of personal data by a controller or processor having its seat (domicile or residence) in Serbia as part of activities being carried out in Serbia, regardless of whether the data processing is carried out in Serbia. Application of the Law has also been extended to the processing of personal data of persons residing or domiciled in Serbia by controllers or processors outside of Serbia, if the processing activities are related to the offer of goods or services to a data subject in Serbia, whether for payment or not, and to monitoring the activities of the data subject if carried out in Serbia.

4. Double penalties

The new Law prescribes double the maximum penalties compared to the current law. However, the Law has not achieved full compliance with the GDPR in this respect. The maximum penalty for a breach of the Law is now RSD 2 million (approx. EUR 17,000). This is still far less than the penalties imposed by the GDPR, which provides for a maximum penalty of up to 4 % of global annual turnover for the preceding financial year, or EUR 20 million, whichever is higher.

5. Consent to processing

Unlike the old law that requires a handwritten form of consent (which due to technological advances caused enormous problems in practice), the new Law now includes an extended definition of consent. Consent is now defined as any freely given, specific, informed and unambiguous expression of will of a person, by which that person, through a statement or clear affirmative action, grants their consent to the processing of personal data relating to them. Consent can now also be granted online in accordance with the "tick-the-box" principle, which greatly facilitates e-commerce and all types of business using modern electronic technologies.

6. Rights of data subjects

6.1 Notification of breach

The controller must notify the data subject of the breach without delay if the breach can result in high risk to the data subject's rights and freedoms.

6.2 Right to access

The controller is obliged at the data subject's request to provide a free copy of the data being processed. The delivery may also be made electronically. This change significantly increases transparency and improves the position of data subjects.

6.3 Right to correction of data

This right allows incorrect data about the data subject to be corrected, without undue delay.

6.4 Right to delete data

The data subject is entitled to ask the controller to delete personal data, to cease further data transmission, and stop the processing of data by third parties in the case of deletion of data. Data must be deleted if it is no longer necessary to achieve the purpose of the processing or if consent to processing has been revoked. When deciding on a request for data deletion, it is also necessary to consider the public interest in the availability of these data, which may outweigh the private interest in erasing it, in which case there will be no deletion (the Law prescribes other exceptions to this rule).

6.5 Right to limit the scope of processing

The data subject is entitled to limit the processing of their data by the controller in the following cases: (i) if the data subject contests the accuracy of the data; (ii) if the processing is illegal, and the data subject is opposed to deletion and instead requests restriction of the use of the data; (iii) if the controller no longer needs the personal data for the purpose of the processing, but the data subject requested it for the purpose of submitting, exercising or defending a legal claim; and (iv) if the data subject has lodged an objection to the processing, and the assessment of whether the legal basis for processing by the controller prevails over the interests of that person is ongoing.

6.7 Right to data portability

The person that previously provided data to the controller shall have the right to receive data from the controller in a structured, commonly used and machine-readable format, and the right to transmit this information to another controller, without interference from the first controller.

7. More precise and detailed definition of personal data

The Law introduces a more precise and detailed definition of personal data to ensure the broadest legal protection possible for individuals. Personal data is thus defined as any data that refers to a natural person whose identity has been determined or is determinable, directly or indirectly, based on identity parameters, such as name or identification number, location data, identifiers in electronic communication networks or one or more features of the person's physical, physiological, genetic, mental, economic, cultural or social identity. According to the Law, a natural person can now be determined based on identifiers in electronic communication networks, based on their devices, applications, tools and protocols, such as internet address protocols, cookie identifiers or other identifiers, such as radio frequency labels.

8. Protection measures

The controller must implement necessary protection mechanisms during processing to protect the rights and freedoms of data subjects. When determining the processing method, or during processing, the controller must (i) use appropriate technical, organisational and personnel measures, such as pseudonymisation, aimed at ensuring the effective application of personal data protection principles, such as reducing the amount of data; and (ii) ensure the application of necessary protection mechanisms during processing to meet conditions for processing as prescribed by this Law and to protect the rights and freedoms of data subjects. The controller must ensure through the application of technical, organisational and personnel measures that only those personal data necessary for the realisation of each individual processing purpose are processed. This refers to the collection of data, the scope of its processing, the duration of data retention and data availability.

9. Transfer of personal data to other countries

The Law regulates the procedure for the transfer of personal data out of the country in more detail, based on an adequate level of data protection. An adequate level of data protection is provided in countries and international organisations that are members of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, or in countries or international organisations that the EU has determined provide an adequate level of protection. The primary level of protection is deemed to be provided if an international data transfer agreement is concluded. The government's list of countries that provide or do not provide the adequate level of protection shall be published in the Official Gazette. If transfer is planned to a country that is not on the list of countries providing an adequate level of protection, the transfer can only be carried out if data protection measures are ensured and if protection of rights and legal protection of the data subject is provided, with the special consent of the Commissioner.

10. Legal remedies and liability

In addition to an appeal, which is already prescribed, several legal remedies available to the data subject are now envisaged in the event of a breach of their rights, such as: (i) an objection to the controller about the manner in which data are processed; (ii) the right to direct a complaint to the Commissioner; (iii) the right to initiate an administrative dispute; and (iv) direct judicial protection (review of a final judgment rendered on claims under paragraphs 2 and 3 of Article 84 of the Law).

11. More complete regulation of personal data security

Several personal data protection measures (technical, organisational and personnel) are prescribed:

• pseudonymisation and cryptographic data protection;
• ensuring indefinite confidentiality, integrity, availability and resilience of processing systems and services;
• re-access and availability in case of physical or technical disruption; and
• regular testing of processing safety measures.

A procedure is also prescribed in case a breach occurs, i.e. the obligation to notify the supervisory body and data subjects. The controller must document every personal data breach, including facts about the breach, its consequences and activities undertaken to eliminate them, and this documentation will serve as a basis for the Commissioner when determining whether the controller acted in accordance with the Law.

12. Privacy impact assessment (PIA)

If some type of processing is likely to result in a high risk to the rights and freedoms of natural persons, in particular due to the use of new technologies and taking into account the nature, scope, circumstances and purpose of processing, before starting the processing the controller shall assess its impact on personal data protection. The Law further specifies cases in which an impact assessment is required. These include large-scale systematic surveillance in public areas, and systematic and comprehensive assessment of the status and characteristics of a natural person with the aid of automated processing, including profiling, etc.

13. Data protection officer (DPO)

A personal data protection officer must be appointed when the core activities of the controller or processor consist of processing operations which, by their nature, scope or purpose, require regular and systematic monitoring of many data subjects or processing of special categories of data.

14. Penalty provisions

The Law foresees cases where a fine ranging from RSD 50,000 to RSD 2 million shall be imposed on a controller or processor having the status of a legal entity. This fine represents a difference in relation to the GDPR, which stipulates a maximum fine of up to EUR 2,000,000, i.e. up to 4 % of global annual turnover for the preceding financial year.

15. Conclusion

Although the Law has largely adopted provisions and solutions from the GDPR, it is not harmonised with the GDPR in some respects, in particular those most important to ensuring its practical implementation (such as fines). It remains to be seen whether effective implementation will be achieved, or if Serbia will remain behind EU countries with respect to fundamental rights to privacy and personal data protection.

This article was authored by Vlajkovic Marija & Aleksa Damjanac